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Summary 1 


Self-Regulatory Principles for 
Online Behavioral Advertising 


SUMMARY 


OVERVIEW 

The cross-industry Self-Regulatory Program for Online Behavioral Advertising was 
developed by leading industry associations to apply consumer-friendly standards 

to online behavioral advertising across the Internet. Online behavioral advertising 
increasingly supports the convenient access to content, services, and applications over 


the Internet that consumers have come to expect at no cost to them. 


The Self-Regulatory Program consists of seven Principles. These Principles, described 
below, correspond with the “Self-Regulatory Principles for Online Behavioral Adver- 
tising” proposed by the Federal Trade Commission in February 2009, and also address 


public education and industry accountability issues raised by the Commission. 


SCOPE AND APPLICATION 

The Principles are intended to apply broadly to the diverse set of actors that work in- 
terdependently to deliver relevant advertising intended to enrich the consumer online 
experience. Many of the entities and practices to which they apply are covered by self- 


regulatory principles for the first time in this area. 


Summary 


The Principles apply to online behavioral advertising, defined as the collection of 
data online from a particular computer or device regarding Web viewing behaviors 
over time and across non-affiliate Web sites for the purpose of using such data to 
predict user preferences or interests to deliver advertising to that computer or device 
based on the preferences or interests inferred from such Web viewing behaviors. The 
Principles do not apply to a Web site’s collection of viewing behavior solely for its own 
uses. Contextual advertising also is not covered by the Principles as it delivers adver- 
tisements based on the content of a Web page, a search query, or a user’s contempora- 


neous behavior on the Web site. 


THE PRINCIPLES 

The Education Principle calls for entities to participate in efforts to educate consumers 
and businesses about online behavioral advertising. It is expected that there will exist 
a robust industry-developed Web site(s) that provide consumers with educational 
material about online behavioral advertising. Additionally, it will result in numerous 
online impressions educating the public about how online behavioral advertising 


works and the choices that are available to consumers. 


The Transparency Principle requires the deployment of multiple mechanisms for clearly 
disclosing and informing consumers about data collection and use practices associated 
with online behavioral advertising. This Principle applies to entities collecting and 
using data for online behavioral advertising and to the Web sites from which such data 
is being collected and used by third parties. Compliance with this Principle will result 


in new links and disclosures on the Web page or advertisement where online behay- 


ioral advertising occurs. 





Summary 


The Consumer Control Principle provides for mechanisms that will enable users of Web 
sites at which data is collected for online behavioral advertising purposes the ability 

to choose whether data is collected and used or transferred to a non-affiliate for such 
purposes. The choice will be provided by the third party entities collecting and using 
data for online behavioral advertising and the mechanism will be found either at their 
own Web sites or at industry-developed Web sites. The new links and disclosures on 


the Web pages or advertisements will direct consumers to these mechanisms. 


The Transparency and Consumer Control Principles have separate provisions for 
“service providers” engaged in online behavioral advertising. Under these Principles, 
service providers must provide additional notice regarding the online behavioral ad- 
vertising that occurs by use of their services, obtain the consent of users before engag- 
ing in online behavioral advertising, and take steps to de-identify the data used for 
such purposes. Internet access service providers and providers of desktop applications 
software such as Web browser “tool bars” are examples of service providers under these 


Principles. 


The Data Security Principle requires entities to provide reasonable security for, and lim- 


ited retention of, data collected and used for online behavioral advertising purposes. 


The Material Changes Principle directs entities to obtain consent before applying any 


change to their online behavioral advertising data collection and use policy that is less 


restrictive to data collected prior to such material change. 





Summary 


The Sensitive Data Principle recognizes that certain data collected and used for on- 
line behavioral advertising purposes merits different treatment. The Principles apply 
heightened protection for children’s data by applying the protective measures set forth 
in the Children’s Online Privacy Protection Act. Similarly, this Principle requires 
consent for the collection of financial account numbers, Social Security numbers, 
pharmaceutical prescriptions, or medical records about a specific individual for online 


behavioral advertising purposes. 


The Accountability Principle calls upon entities representing the wide range of actors 

in the online behavioral advertising ecosystem to develop and implement policies and 
programs to further adherence to these Principles. It is intended that these programs 
will help ensure that all entities engaged in online behavioral advertising bring their 
activities into compliance with these Principles. The Direct Marketing Association, 
which has more than 3,500 members, has indicated that it will integrate the Principles 
into its long-standing effective self-regulatory program. The Council of Better Business 
Bureaus, with a long history of successful accountability programs, has indicated that 


it is developing a new program around these Principles. 


The Accountability Principle calls for programs to have mechanisms by which they 
can police entities engaged in online behavioral advertising and help bring these 


entities into compliance. Programs will also publicly report instances of uncorrected 


violations to the appropriate government agencies. 
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IMPLEMENTATION OF THE TRANSPARENCY 

AND CONSUMER CONTROL PRINCIPLES 

For consumers, the most visible effects of the Self-Regulatory Program will result from 
implementation of the Transparency and Consumer Control Principles by entities that 
collect Web viewing data for online behavioral advertising purposes and by the Web 
sites on which such data is collected and used. The “enhanced notice” approach re- 
quired by the Transparency Principle will offer consumers the ability to exercise choice 
regarding the collection and use of data for online behavioral advertising through one 
of several avenues. Links to consumer notices will be clear, prominent, and conve- 
niently located. This enhanced notice will be provided at the Web sites from which 
data is collected. Such enhanced notice will be provided at the time of such collec- 
tion and use, through common wording and a link/icon that consumers will come to 
recognize. The opportunity for Web site users to exercise choices about whether Web 
viewing data can be collected and used for online behavioral advertising will never be 


more than a few clicks away from such standardized wording and link/icon. 


To implement enhanced notice, an entity that collects and uses data for online behav- 
ioral advertising purposes will provide at least two mechanisms for consumer notice. 
First, an entity will provide consumer notice on its own Web site. Second, an entity 
will provide consumer notice at the time that data is collected and used for online 
behavioral advertising. One option for providing this second form of notice is for an 
entity to attach a uniform link/icon and wording to each advertisement that it serves. 
Clicking on this link/icon will provide a disclosure from the entity in the form of 

an expanded text scroll, a disclosure window, or a separate Web page. In this notice, 
the entity will both disclose its online behavioral advertising practices and provide a 


mechanism for exercising choice regarding such practices. 


Summary 


In addition, Web sites on which such data is collected and used for online behavioral 
advertising will place the prominent wording and link/icon on the Web page where 
data is collected and used for online behavioral advertising. (Where the link/icon is 
provided in the advertisements by the entity collecting the data, a separate Web site 
notice is not required.) Clicking on this link/icon will take consumers to the Web site’s 
disclosure regarding online behavioral advertising. The disclosure provided by the 
Web site must include either (1) a list of entities that collect data on that Web site for 
online behavioral advertising purposes, with links to each entity’s online consumer 
notice and choice, or (2) a link to an industry-developed Web site that will contain 
mechanisms for choosing whether each participating entity may collect and use data 


for online behavioral advertising purposes. 


In short, consumer choice and enhanced notice will be available through new links 


located in advertisements themselves or on the Web page where data is collected for 


online behavioral advertising. 
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Self-Regulatory Principles for 
Online Behavioral Advertising 


PRINCIPLES 


Today’s advertising-supported Internet offers consumers across the globe quick, 
convenient, and free access to an unparalleled range of communication and 
information resources. As the Internet has evolved, and in response to calls for more 
robust and effective self-regulation of online behavioral advertising practices that 
increasingly support the provision of Internet content, representatives of a wide range of 
the participants in the Internet advertising ecosystem together developed the Principles 
set forth herein to better foster transparency, knowledge, and choice for consumers. 
These Principles are intended to apply consumer-friendly standards to Online 
Behavioral Advertising, the collection of data online from a particular computer or 
device regarding Web viewing behaviors over time and across non-affiliate Web sites for 
the purpose of using such data to deliver advertising to that computer or device based 


on the preferences or interests inferred from such Web viewing behaviors. 


The Principles apply across the Internet, which is comprised of a diverse set of 
participants that work interdependently to provide seamless delivery of relevant 
advertising intended to enrich the consumer online experience. This ecosystem includes 
advertisers, advertising agencies, Web publishers, Internet access service providers, 
providers of desktop application software such as Web toolbars and Internet Web 


browsers, and online advertising networks. Search offerings and search engines also fall 


within the scope of these Principles when such offerings include an Online Behavioral 





Principles 


Advertising component. Thus, when search data is part of data collected over time and 
across sites for Online Behavioral Advertising, it falls within the scope of the Principles 
including the applicable transparency and choice provisions. This inclusive approach 
has the dual benefits of providing for continued delivery of advertising that is relevant 
for individual consumers and useful for advertisers, while at the same time protecting 
information and giving consumers a greater degree of understanding about and control 


over the collection and use of the data used to deliver relevant advertising to them. 


These Principles apply to an extensive and diverse set of entities and practices, many 
of which are covered by self-regulatory principles for the first time in this area. While 
the Principles are intended to apply broadly across the wide range of entities in the 
ecosystem, they also take into consideration the different roles that companies may play 
in different contexts within the ecosystem, and address their respective data practices 
accordingly. In many cases, an individual company may function in more than one 
capacity within the ecosystem. For example, a company can be a Web publisher in its 
provision of content or retail products on its Web site, can be an advertiser through 
advertisements on non-affiliate Web sites, can serve as an Internet access service pro- 
vider, can offer desktop application software such as a toolbar, and can also function 
in certain circumstances as an ad network. A company’s actions would be governed by 
the respective Principle related to the particular role or roles the company fulfills in the 


ecosystem in collecting and using data for Online Behavioral Advertising purposes. 


This document begins with the definitions of terms used in the Principles, and then sets 
forth Principles for improved transparency and choice with respect to data 
collected and used to deliver Online Behavioral Advertising. This document should 


be read in conjunction with the Commentary, which discusses and provides authorita- 


tive interpretations of the Principles. 
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Definitions 


A. AD DELIVERY 


Ad Delivery is the delivery of online advertisements or advertising-related ser- 
vices using Ad Reporting data. Ad Delivery does not include the collection and 
use of Ad Reporting data when such data is used to deliver advertisements to a 
computer or device based on the preferences or interests inferred from informa- 
tion collected over time and across non-Affiliate sites because this type of collec- 


tion and use is covered by the definition of Online Behavioral Advertising. 


B. ADREPORTING 


Ad Reporting is the logging of page views on a Web site(s) or the collection or 
use of other information about a browser, operating system, domain name, date 
and time of the viewing of the Web page or advertisement, and related informa- 


tion for purposes including but not limited to: 
e Statistical reporting in connection with the activity on a Web site(s); 
e Web analytics and analysis; and 


* Logging the number and type of advertisements served on a particular Web site(s). 


C. AFFILIATE 


An Affiliate is an entity that Controls, is Controlled by, or is under common 


Control with, another entity. 


10 
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CONSENT 


Consent means an individual’s action in response to a clear, meaningful and 
prominent notice regarding the collection and use of data for Online Behavioral 


Advertising purposes. 


CONTROL 


Control of an entity means that one entity (1) is under significant common own- 
ership or operational control of the other entity, or (2) has the power to exercise 

a controlling influence over the management or policies of the other entity. In 
addition, for an entity to be under the Control of another entity and thus be 
treated as a First Party under these Principles, the entity must adhere to Online 
Behavioral Advertising policies that are not materially inconsistent with the other 


entity’s policies. 

FIRST PARTY 

A First Party is the entity that is the owner of the Web site or has Control over 
the Web site with which the consumer interacts and its Affiliates. 


ONLINE BEHAVIORAL ADVERTISING 


Online Behavioral Advertising means the collection of data from a particular 
computer or device regarding Web viewing behaviors over time and across non- 


Affiliate Web sites for the purpose of using such data to predict user preferences 


or interests to deliver advertising to that computer or device based on the prefer- 
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ences or interests inferred from such Web viewing behaviors. Online Behavioral 
Advertising does not include the activities of First Parties, Ad Delivery or Ad Re- 
porting, or contextual advertising (i.e. advertising based on the content of the Web 


page being visited, a consumer’s current visit to a Web page, or a search query). 


PERSONALLY IDENTIFIABLE INFORMATION (“PII”) 


Personally Identifiable Information is information about a specific individual 
including name, address, telephone number, and email address-- when used to 


identify a particular individual. 


SERVICE PROVIDER 


An entity is a Service Provider to the extent that it collects and uses data from all 
or substantially all URLs traversed by a web browser across Web sites for Online 
Behavioral Advertising in the course of the entity’s activities as a provider of 
Internet access service, a toolbar, an Internet browser, or comparable desktop 


application or client software and not for its other applications and activities. 


THIRD PARTY 


An entity is a Third Party to the extent that it engages in Online Behavioral Ad- 


vertising on a non-Affiliate’s Web site. 
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Principles 


l. EDUCATION 


Entities should participate in efforts to educate individuals and businesses about 
Online Behavioral Advertising, including the actors in the ecosystem, how data 


may be collected, and how consumer choice and control may be exercised. 


Il. TRANSPARENCY 
A. THIRD PARTY AND SERVICE PROVIDER NOTICE 


1. THIRD Party AND SERVICE PRovIDER Privacy Notice — Third Parties and 
Service Providers should give clear, meaningful, and prominent notice on 
their own Web sites that describes their Online Behavioral Advertising 
data collection and use practices. Such notice should include clear descrip- 


tions of the following: 


(a) The types of data collected online, including any PII for Online 


Behavioral Advertising purposes; 


(b) The uses of such data, including whether the data will be transferred 


to a non-Affiliate for Online Behavioral Advertising purposes; 


(c) An easy to use mechanism for exercising choice with respect to 
the collection and use of the data for Online Behavioral Advertis- 
ing purposes or to the transfer of such data to a non-Affiliate for 


such purpose; and 


(d) The fact that the entity adheres to these Principles. 
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2. Tard Party ENHANCED Norice To Consumers — In addition to providing 


notice as described in (1), Third parties should provide enhanced notice as 
set forth below in (a) or (b): 


(a) Third Party Advertisement Notice — Third Parties should provide 
notice of the collection of data through a clear, meaningful, and 


prominent link to a disclosure described in II.A.(1): 


(i) In or around the advertisement delivered on the Web page 


where data is collected; or 


(ii) On the Web page where the data is collected if there is an 


arrangement with the First Party for the provision of such 


notice. 


(b) Third Party Participation in Industry-Developed Web Site(s) — Third 
Parties should be individually listed either: 


(i) On an industry-developed Web site(s) linked from the disclo- 


sure described in II.B; or 


(ii) If agreed to by the First Party, in the disclosure on the Web 
page where data is collected for Online Behavioral Advertising 


purposes as described in II.B. 
B. Wes Site Notice of THIRD PARTY ONLINE BEHAVIORAL ADVERTISING 


When data is collected from or used on a Web site for Online Behavioral 
Advertising purposes by Third Parties, the operator of the Web site should 
include a clear, meaningful, and prominent link on the Web page where data 


is collected or used for such purposes that links to a disclosure that either 
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points to the industry-developed Web site(s) or individually lists such Third 
Parties. A Web site does not need to include such a link in instances where 
the Third Party provides notice as described in II.A.(2)(a). A Web site should 


also indicate adherence to these Principles in its notice. 


Il. CONSUMER CONTROL 
A. THIRD PARTY CHOICE FOR BEHAVIORAL ADVERTISING 


A Third Party should provide consumers with the ability to exercise choice 
with respect to the collection and use of data for Online Behavioral Advertis- 
ing purposes or the transfer of such data to a non-Affiliate for such purpose. 
Such choice should be available from the notice described in II.A.(2)(a); from 
the industry-developed Web page(s) as set forth in II.A.2.(b)(i); or from the 
Third Party’s disclosure linked to from the page where the Third Party is indi- 
vidually listed as set forth in II.A.2.(b)(ii). 


B. SERVICE PROVIDER CONSENT FOR BEHAVIORAL ADVERTISING 


1. CONSENT TO COLLECTION AND Use — Service Providers should not collect 


and use data for Online Behavioral Advertising purposes without Consent. 


2. WITHDRAWING ConsENT — Service Providers that have obtained Consent 
for collection and use of such data for Online Behavioral Advertising 
purposes should provide an easy to use means to withdraw Consent to the 


collection and use of that data for Online Behavioral Advertising. 
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IV. DATA SECURITY 
A. SAFEGUARDS 


Entities should maintain appropriate physical, electronic, and administra- 
tive safeguards to protect the data collected and used for Online Behavioral 


Advertising purposes. 
B. Data RETENTION 


Entities should retain data that is collected and used for Online Behavioral 
Advertising only as long as necessary to fulfill a legitimate business need, or 


as required by law. 
C. SERVICE PROVIDER TREATMENT OF ONLINE BEHAVIORAL ADVERTISING DATA 


Service Providers should take all of the following steps regarding data col- 


lected and used for Online Behavioral Advertising purposes: 


1. Alter, anonymize, or randomize (e.g., through “hashing” or sub- 
stantial redaction) any PII or unique identifier in order to prevent 
the data from being reconstructed into its original form in the 


ordinary course of business. 


2. Disclose in the notice set forth in IJ.A.1 the circumstances in 
which data that is collected and used for Online Behavioral Adver- 


tising is subject to such a process. 


3. Take reasonable steps to protect the non-identifiable nature of data 


if it is distributed to non-Affiliates including not disclosing the 


algorithm or other mechanism used for anonymizing or randomiz- 
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ing the data, and obtaining satisfactory written assurance that such 
entities will not attempt to re-construct the data and will use or 
disclose the anonymized data only for purposes of Online Behav- 
ioral Advertising or other uses as specified to users. This assurance 
is considered met if a non-Affiliate does not have any independent 


right to use the data for its own purposes under a written contract. 
8 purp 


4. Take reasonable steps to ensure that any non-Affiliate that receives 
anonymized data will itself ensure that any further non-Affiliate 
entities to which such data is disclosed agree to restrictions and 
conditions set forth in this subsection. This obligation is also con- 
sidered met if a non-Affiliate does not have any independent right 


to use the data for its own purposes under a written contract. 


V. MATERIAL CHANGES TO EXISTING ONLINE BEHAVIORAL ADVERTISING 
POLICIES AND PRACTICES 


Entities should obtain Consent before applying any material change to their On- 
line Behavioral Advertising data collection and use policies and practices prior to 
such material change. A change that results in less collection or use of data would 
not be “material” for purposes of this Principle. 

VI. SENSITIVE DATA 


A. CHILDREN 


Entities should not collect “personal information”, as defined in the Chil- 


dren’s Online Privacy Protection Act (“COPPA”), from children they have 
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actual knowledge are under the age of 13 or from sites directed to children 
under the age of 13 for Online Behavioral Advertising, or engage in Online 
Behavioral Advertising directed to children they have actual knowledge are 


under the age of 13 except as compliant with the COPPA. 
B. HEALTH AND FINANCIAL Data 


Entities should not collect and use financial account numbers, Social Securi- 
ty numbers, pharmaceutical prescriptions, or medical records about a specific 


individual for Online Behavioral Advertising without Consent. 
VII. ACCOUNTABILITY 


A. APPLICABILITY 


These Principles are self-regulatory in nature and entities engaged in Online 


Behavioral Advertising are within the scope of the accountability programs. 
B. OPERATION 


Accountability programs on Online Behavioral Advertising shall have in 


place processes that do the following: 


1. MONITORING — Programs will systematically or randomly monitor the 
Internet for compliance with the Principles. Programs will maintain a 
process for taking complaints from the public, from competitors, and 
from government agencies concerning possible non-compliance with 


the Principles. 
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2. TRANSPARENCY AND REPORTING — Program findings of non-compliance 
(in particular those that are not corrected), the reasons for those find- 
ings, and any actions taken with respect to instances of non-compli- 


ance, will be publicly reported by the programs. 


3. Comruance — When an entity engaged in Online Behavioral Adver- 
tising is informed by a program regarding its non-compliance with 
the Principles, the entity should take steps to bring its activities into 
compliance with the Principles. The programs will send the public 
reports of uncorrected violations (set forth in (2)) to the appropriate 


government agencies. 
C. RELATIONSHIP AMONG ACCOUNTABILITY PROGRAMS 


1. Administrators of the programs should discuss coordination on 
accountability to help ensure efficiencies so that entities engaged in 
Online Behavioral Advertising are not unreasonably subject to mul- 
tiple enforcement mechanisms regarding their possible non-compli- 
ance with the Principles and consumers have simple mechanisms to 


complain about possible non-compliance with the Principles. 


2. Accountability programs should be linked to industry-developed 
Web site(s) and decisions made public as described in VII.B.2. 


should either be posted or a link to them should be available from 


such site(s). 
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Self-Regulatory Principles for 
Online Behavioral Advertising 


COMMENTARY 


SCOPE & PURPOSE 

Today’s advertising-supported Internet offers consumers across the globe quick, con- 
venient, and free access to an unparalleled range of communication and information 
resources. As the Internet has evolved, and in response to calls for more robust and 
effective self-regulation of behavioral advertising practices that increasingly support 
the provision of Internet content, representatives of a wide range of the participants in 
the Internet advertising ecosystem together developed the Principles set forth herein to 
better foster transparency, knowledge, and choice for consumers. These Principles are 
intended to apply consumer-friendly standards to Online Behavioral Advertising, the 
collection of data online from a particular computer or device regarding Web view- 
ing behaviors over time and across non-affiliated Web sites for the purpose of using 
such data to deliver advertising to that computer or device based on the preferences or 


interests inferred from such Web viewing behavior. 


The Principles apply across the entire Internet, which is comprised of a diverse set of 
participants that work interdependently to provide seamless delivery of relevant adver- 
tising intended to enrich the consumer online experience. This ecosystem includes 
advertisers, advertising agencies, Web publishers, Internet access services providers, 
providers of desktop application software such as Web toolbars and Internet Web 
browsers, and online advertising networks. Search offerings and search engines also fall 


within the scope of these Principles when such offerings include an Online Behavioral 
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Advertising component. Thus, when search data is part of data collected over time and 
across sites for Online Behavioral Advertising, it falls within the scope of the Principles 
including the applicable transparency and choice provisions. This inclusive approach 
has the dual benefits of providing for continued delivery of advertising that is relevant 
for individual consumers and useful for advertisers, while at the same time protecting 
information and giving consumers a greater degree of understanding about and control 


over the collection and use of the data used to deliver relevant advertising to them. 


These Principles apply to an extensive and diverse set of entities and practices, many 
of which are covered by self-regulatory principles for the first time in this area. While 
the Principles are intended to apply broadly across the wide range of entities in the 
ecosystem, they also take into consideration the different roles that companies may 
play in different contexts within the ecosystem, and address their respective data 
practices accordingly. In many cases, an individual company may function in more 
than one capacity within the ecosystem. For example, a company can be a Web pub- 
lisher in its provision of content or retail products on its Web site, can be an advertiser 
through advertisements on non-affiliate Web sites, can serve as an Internet access 
service provider, can offer desktop application software such as a toolbar, and can also 
function in certain circumstances as an ad network. A company’s actions would be 
governed by the respective principle related to the particular role or roles the company 
fulfills in the ecosystem in collecting and using data for Online Behavioral Advertis- 


ing purposes. 


This document, which provides authoritative interpretations of the Principles, be- 
gins with the definition of terms used in the Principles, and then sets forth the seven 


Principles. As explained further below, the Principles apply differing standards to the 


activities of the Web site (i.e., the First Party), Third Parties and Service Providers. 
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Definitions 


This part contains definitions for terms used in these guidelines. Among the terms 


defined are: 


“AD DELIVERY” — The term Ad Delivery means the delivery of online advertisements 
or advertising-related services using Ad Reporting Data. Ad Delivery does not include 
the collection and use of Ad Reporting data when such data is used to deliver adver- 
tisements to a computer or device based on the preferences or interests inferred from 
information collected over time and across non-Affiliate sites because this type of 


collection and use is covered by the definition of Online Behavioral Advertising. 


An entity would be engaged in Ad Delivery for its provision of ad serving technologies 
where the entity is merely providing the underlying technology that is used by another 
entity that is engaged in Online Behavioral Advertising and is, therefore, not actually 
engaged in the collection or use of data for Online Behavioral Advertising. Such Ad 
Delivery is not covered by the definition of Online Behavioral Advertising and is thus 
outside of the requirements in the Principles. Such services are outside of the defini- 
tion of Online Behavioral Advertising because the responsibility for complying with the 


Principles lies with the entity that is actually engaged in Online Behavioral Advertising. 


“AFFILIATE” AND “CONTROL” — These terms set an objective test to separate related 
First Party entities from Third Parties and others. An Affiliate is defined as an entity 
that Controls, is Controlled by, or is under common Control with, another entity. The 
definition of Control sets out two alternative tests, which reflect a commonly under- 


stood definition of a single entity. The first alternative looks to whether one entity is 
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under significant common ownership with the other entity. The second alternative 
looks to whether one entity has the power to exercise a controlling influence over the 
management or policies of the other. In addition, each entity must be subject to 
Online Behavioral Advertising policies that are not materially inconsistent with the 
other entity’s Online Behavioral Advertising policies. The combination of Control 
and governance by similar Online Behavioral Advertising policies renders the two 


entities Affiliates of each other. 


The tests for Control are unrelated to brand names. As a result, different brands, if 
they otherwise meet one of the tests for Control, would be treated as Affiliates rather 


than Third Parties. 


The starting point for whether two or more affiliated consumer-facing Web sites 
constitute a First Party under the Principles is whether the Web sites are the same 
company. The use of the term Affiliate is intended to allow affiliated companies that 
are in the same corporate family to share information within that family as if they are 
the same company, thereby benefitting from their collective assets. The treatment of 
Affiliates is not intended to create a means for companies that are in reality unrelated 
in corporate structure (and, therefore, that consumers would never expect would be 
sharing information,) to avoid providing the choice required under these Principles. In 
many cases companies can readily be transparent either in branding on the Web sites 
or through clarity in the privacy notices of their particular Affiliates. Assuming an 
entity otherwise meets the standard set forth in the definition of Control, such prac- 
tices would clearly satisfy and permit inclusion in the definition of Affiliate. However, 
such branding on a Web site or inclusion in a privacy notice is not required under the 


Principles as in some instances the complexity of corporate affiliates driven by corpo- 


rate legal principles pose practical operational challenges. 
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“CONSENT” — The term Consent means an individual’s action in response to a clear, 
meaningful and prominent notice regarding the collection and use of data for Online 


Behavioral Advertising purposes. 


“ONLINE BEHAVIORAL ADVERTISING” AND “FIRST PARTY” — Online Behavioral 
Advertising means the collection of data from a particular computer or device regard- 
ing Web viewing behaviors over time and across non-Affiliate Web sites for the purpose 
of using such data to predict user preferences or interests to deliver advertising to that 
computer or device based on the preferences or interests inferred from such Web view- 
ing behaviors. The term Online Behavioral Advertising, as defined in the Principles, 
does not include the activities of First Parties, Ad Delivery or Ad Reporting, or contex- 
tual advertising (i.e. advertising based on the content of the Web page being visited, a 


consumer’s current visit to a Web page, or a search query). 


Agents and other entities that perform business operations of First Parties are treated as 
if they stand in the shoes of First Parties under these Principles and thus, their activities 
are not included in Online Behavioral Advertising. Similarly, this traditional legal con- 
struct of agents would apply to Third Parties and Service Providers and their agents and 
other entities that perform business operations of Third Parties and Service Providers. 
If the agent is taking on the responsibility for the Third Party or Service Provider, either 
the agent or that entity would have to satisfy the obligations under these Principles. 
Thus, an entity cannot escape its obligations by outsourcing its responsibilities to 


an agent. 


For purposes of the Principles, a First Party is the owner of a Web site or the Web site 


of an Affiliate at which data is collected regarding Web viewing behaviors (by the First 


Party on behalf of itself, its Affiliates and/or its advertising partners). 
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In addition, in certain situations where it is clear that the consumer is interacting with 
a portion of a Web site that is not an advertisement and is being operated by a differ- 
ent entity than the owner of the Web site, the different entity would not be a Third 
Party for purposes of the Principles, because the consumer would reasonably under- 
stand the nature of the direct interaction with that entity. The situation where this 
occurs most frequently today is where an entity through a “widget” or “video player” 
enables content on a Web site and it is clear that such content is not an advertisement 
and that portion of the Web site is provided by the other entity and not the First Party 
Web site. The other entity (e.g., the “widget” or “video player”) is directly interacting 
with the consumer and, from the consumer’s perspective, acting as a First Party. Thus, 
it is unnecessary to apply to these activities the Principles governing data collection 


and use by Third Parties with which the consumer is not directly interacting. 


Contextual advertising, or advertising based on a consumer’s current visit to a Web page 
or search query, is also outside the scope of Online Behavioral Advertising. The activi- 
ties of search engines fall within the scope of Online Behavioral Advertising to the 
extent that they include collection of data regarding Web viewing behaviors over time 
and across non-Affiliate Web sites in order to deliver advertising to that computer or 


device based on the preferences or interests inferred from such Web viewing behaviors. 


All references to data collection and use in the Principles are for data collected online 
and used for Online Behavioral Advertising purposes. Data collected and used for 


other purposes falls outside of the definition of Online Behavioral Advertising and 


these Principles. 
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“PERSONALLY IDENTIFIABLE INFORMATION” (“PII”) — PII includes the following 
information about a specific individual: name, address, telephone number, and email 
address — when used to identify a particular individual. For the limited purposes for 
which PII is used in these Principles and Commentary, a functional definition of PII 
is used that is intended to apply to the various business models most directly involved 


in Online Behavioral Advertising. 


PII is a term used primarily in two areas in the Principles and Commentary. First, 

PII is used in the Transparency principle so that consumers are informed specifi- 
cally about the collection and use of PII for Online Behavioral Advertising purposes. 
Second, PII is used in this Commentary to describe a specific example of a “material” 


change that would require Consent from the consumer under Principle V. 


Data is not considered PII under the Principles if the data is not used in an identifiable 
manner. For example, in situations where an IP address is not linked with other PII, 
the IP address itself would not in most instances be PII for purposes of these Principles. 
In instances where an IP address is in fact linked to an individual in its collection and 
use, in most instances the IP address would be PII for purposes of these Principles. 

A similar analysis would apply for other persistent identifiers such as a customer 
number held in a cookie or processor serial number. When such identifier is in fact 
coupled with an individual identifier within the definition of PII, such as first and last 
name, such information would be PII for purposes of the Principles. When such data 
is not coupled with an individual identifier within the PII definition, the data would 
not be PII. 


26 





Commentary 


The definition of PII is included in the Principles for the reasons described above. In- 
clusion of the definition should not be viewed as limiting the scope of the Principles. 
Generally speaking, the Principles apply to online data regardless of whether or not the 
data referenced in the requirements is PII. Thus, for example, the choice requirements 
apply to all data collected online for Online Behavioral Advertising purposes, not just 


to PII. 


“SERVICE PROVIDER” — This term and the provisions associated with it are a critical 
part of these Principles insofar as they apply similar standards for Online Behavioral 
Advertising purposes to various entities engaged in comprehensive data collection 
activities regarding user Web browsing activities. A Service Provider is defined as an 
entity to the extent that it collects and uses data from all or substantially all URLs 
traversed by a web browser across Web sites for Online Behavioral Advertising in the 
course of its activities as a provider of Internet access service, a toolbar, an Internet 
browser, or comparable desktop application or client software and not for its other 
applications and activities. For example, an Internet access service provider or Web 
browser tool bar plug-in that provide a service that, when used, captures all or substan- 
tially all of the customer’s Web browsing activities would both be Service Providers. 
Ad networks, advertisers or other Third Parties are not Service Providers under these 
Principles because they have a relationship, either directly or indirectly, with the Web 
site with which the consumer is communicating, or because they do not collect and use 


data from all or substantially all URLs traversed by a Web browser across Web sites. 


All aspects of the entire business of an entity that qualifies as a Service Provider for 
a particular service are not subject to the Service Provider requirements. Rather, the 


particular service and information collected in an entity’s capacity as a Service Pro- 


vider falls within the Service Provider definition for Online Behavioral Advertising 
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and therefore is subject to the requirements. The term Service Provider and the guide- 
lines applicable to Service Providers do not apply to the practices of advertisers, ad 
networks, or of Third Parties which, when engaged in Online Behavioral Advertising, 
are not within the definition of Service Provider, but rather are covered under other 
guidelines in these Principles. For example, if an entity’s tool bar application falls 
within the Service Provider definition, that entity would have to obtain Consent for 
the collection and use of data obtained through using the toolbar. The entity would 
not, however, have to obtain Consent for its other applications such as its ad network 
services or other Third Party activities, which would be subject to the Third Party or 
Web site obligations under the Principles. In such scenarios, Third Party activities 
would be subject to the Transparency and Choice Principles applicable to Third Par- 
ties. Likewise, First Party activities would not be subject to the consumer Transparency 


or Consent provisions of the Principles applicable to Service Providers. 


“THIRD PARTY” — A Third Party is defined as an entity that engages in Online Behav- 
ioral Advertising at a non-Affiliate’s Web site. This term recognizes that at the center of 
these Principles are the entities that collect and use data for Online Behavioral Advertis- 


ing purposes. 


In some instances, entities that are Affiliates under the Principles may also be Third 
Parties and subject to the respective Third Party obligations including, without limita- 
tion, transparency and providing choice for Online Behavioral Advertising. For ex- 
ample, if a Web portal and an ad network are under common ownership and the Web 
portal collects and uses data from non-Affiliate Web sites for delivery of ads, or the 
Web portal collects and uses data on Web sites owned by its Affiliates for delivery of 
advertisements on any non-Affiliate Web site, the Web portal would be a Third Party. 
In instances where data is being collected and used solely among Affiliates, then the 


Third Party obligations would not apply. 


28 





Commentary 


An advertiser (i.e. that entity whose product or service is being promoted in the 
advertisement) is a Third Party to the extent that it is collecting data over time and 
across non-Affiliate Web sites in order to predict consumer preferences or interests to 
deliver advertising online on non-Affiliate sites. Where the advertiser is instead us- 
ing an ad network, Service Provider, or other entity to collect the data over time and 
across non-Affiliate Web sites in order to predict consumer preferences or interests to 
deliver its advertisement, and such entity is not providing such data to the advertiser 
for its independent use, the advertiser is not a Third Party and not, in such instances, 
subject to the Principles for such Online Behavioral Advertising. In such instances, 
the ad network, Service Provider or other entity’s practices would be covered by the 
Principles. If, however, the advertiser collects or receives the data and uses the data for 
its own Online Behavioral Advertising purposes, the advertiser would be a Third Party 


and subject to the obligations on Third Parties in the Principles. 


I. EDUCATION 


Entities should participate in efforts to educate individuals and businesses about 
Online Behavioral Advertising. Such efforts should also include education regard- 


ing the provisions of these Principles and consumer choices therein once operable. 


Entities engaged in Online Behavioral Advertising intend in a major campaign 
to describe the benefits of these practices, the means of exercising choice, and 
the effect of such choices. Towards this goal, entities have committed advertising 
that is expected to exceed 500,000,000 online advertising impressions that will 


be dedicated to educate consumers about Online Behavioral Advertising over the 


next 18 months. 
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Industry-developed Web site(s) to provide consumers with educational materials 
regarding Online Behavioral Advertising and consumer choices will be developed. 
It is envisioned that industry education and the industry-developed Web site(s) 
will include items regarding consumer choices and technology tools in addition 

to those in the Principles, including a description of the fact that existing browser 
tools can be used to manage collection and use of data used for Online Behavioral 


Advertising. 


ll. TRANSPARENCY 


This section of the Principles sets forth guidelines appropriate for disclosure and 
transparency of data collection and use practices for Online Behavioral Advertis- 
ing. The Principles are informed by the FTC Staff Report: Self-regulatory Principles 
for Online Behavioral Advertising, dated February 2009, which provided guidance 
regarding the collection and use of data for Online Behavioral Advertising pur- 
poses. These Principles do not encompass practices not considered to be “behav- 
ioral advertising,” or similar practices that do not raise the heightened concerns 
caused by the collection of data over time and across non-Affiliate Web sites. Un- 
der these Principles, practices not considered to be Online Behavioral Advertis- 
ing include contextual advertising, where an ad is based on a consumer’s current 
visit to a particular Web page, and First Party data collection, as long as the data 
is used by the party with which the consumer interacted and is not collected and 


used for the purpose of advertising on Web sites of non-Affiliate entities. 


The principle of Transparency addresses three different types of actors involved 


in the Online Behavioral Advertising ecosystem. First, it requires notices by 
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Third Parties, which are certain entities that collect and use data from the Web 
sites of others. Ad networks are an example of a Third Party under these Prin- 
ciples. Second, it requires notices by Service Providers, which are entities that 
collect and use data by virtue of the services they provide to consumers with 
whom they have relationships and, through those service arrangements, have ac- 
cess to all or substantially all URLs accessed by their users. Internet access service 
providers and providers of desktop application software such as browsers and 
Web tool bars are examples of Service Providers under these Principles. Third, it 
requires notices by the Web sites from which data is being collected and used by 
Third Parties. Finally, this Principle requires that all entities indicate adherence 
to these Principles in their notice. This Principle can be satisfied either by word- 
ing or the logo/icon of a self-regulatory accountability program. Taken together, 
these mechanisms for clearly disclosing and informing the public and consumers 
about data collection and use practices will significantly enhance the transpar- 
ency of Online Behavioral Advertising practices and address certain perceived 


gaps in current practices. 


The Principles call for Third Parties to provide at least two different types of 
notices of their data collection practices in connection with Online Behavioral 
Advertising. They should first provide a notice on their own Web sites. This no- 
tice should be clear, meaningful, and prominent, and describe the types of data 
collected and their uses, as well as an easy to use mechanism for exercising choice 
not to permit the collection and use of the data for Online Behavioral Advertis- 
ing purposes, or the transfer of the data to a non-Affiliate for such purposes. It is 
not intended that this Principle require distinct choice mechanisms for collection 


and transfer. As discussed below, there may be several ways in which Web sites 


and others point to or hyperlink to this notice. 
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Third Parties have a choice as to how they will satisfy the enhanced notice re- 
quirement. The first alternative is for a Third Party to include a link to its notice 
from a location in or around the advertisement on the Web page where the data 
is collected (in a field that is controlled by the Third Party) or from a location 

on the Web page where data is collected. A link to a notice is located “in” an 
advertisement if provided within the content of the advertisement. A link to a 
notice is located “around” an advertisement if provided in the area around the ad 
controlled by the Third Party. Similarly, a link could exist in another place on the 
Web page where the data is collected for Online Behavioral Advertising purposes 
that is “clear, meaningful, and prominent” that is controlled by the Third Party. 
The operator of the Web site displaying the advertisement that is delivered by 

a Third Party is not required to provide this link, but is permitted to cooperate 


with the Third Party to do so. 


The second alternative is for a Third Party to have its name(s) listed either on the 
industry-developed Web site(s) linked from the disclosure required under II.B. 

or, if agreed to by the First Party, individually listed in the disclosure on the Web 
site where the Third Party collects data for use for Online Behavioral Advertising 
purposes. For a First Party to avail itself of this option, the link required under 
II.B must be distinct from the Web publisher’s link to its privacy policy. If the 
Web sites at which the Third Party collects data for use for Online Behavioral 
Advertising purposes do not list the Third Party by name and link to its Web site, 
the only means by which a Third Party can satisfy this alternative requirement 


would be to participate in the industry-developed Web site(s). 


The Principles also call for Service Providers to provide a notice regarding the 


Online Behavioral Advertising that occurs by use of their services. This notice 
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should be clear, meaningful, and prominent, and describe the types of data 
collected and their uses, as well as an easy to use mechanism for exercising choice 
not to permit the collection and use of the data for Online Behavioral Adver- 
tising purposes. The requirement to provide clear, meaningful, and prominent 
notice would not be satisfied by providing notice hidden in lengthy terms and 


conditions. 


The Principles also state that the Web sites at which Third Parties are collect- 

ing data for Online Behavioral Advertising purposes should include a new clear, 
meaningful, and prominent link on their Web sites when Third Parties do not 
provide the notice described in IJ.A.(2)(a). This would link from the Web page 
where data is collected to specific language in a disclosure. If the disclosure 
language is in the privacy notice, the link should go directly to the relevant 
section of the privacy policy where the disclosure is located and not just generally 
to the privacy policy. The disclosure should either list the Third Parties engaging 
in Online Behavioral Advertising at the Web site, or point to the industry- 


developed Web site(s) discussed above. 


Where a Third Party includes a link to its notice from a location in or around the 
advertisement or on the Web page where the data is being collected for Online 
Behavioral Advertising purposes, the Web site has no disclosure obligations, but 
is permitted to include the clear, meaningful, and prominent link to the disclo- 
sure if it desires to do so. Where the Web site provides a clear, meaningful, and 
prominent link on the Web page where data is collected for Online Behavioral 
Advertising purposes that links to the disclosure that points to the industry- 
developed Web site(s), or individually lists the specific Third Parties that may 


collect data from the Web page, then the Web site has satisfied its transparency 
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and choice obligations under the Principles. In such instances, the Third Party 


notice obligation as set forth in II.A.(2)(a), while permitted, would not be required. 


Similarly, the Principles recognize that given the decentralized nature of the 
Internet and delivery of content online that Web sites often do not have visibility 
into the particular Third Party engaged in Online Behavioral Advertising. For 
this reason, a Web site that provides the link on the Web page where the data 

is collected that leads to the industry-developed Web page(s) would be in com- 
pliance with the Principles and the failure of a Third Party engaged in Online 
Behavioral Advertising on such Web site to comply with the Principles and be 
listed on the industry-developed Web site(s) would be a violation of the Prin- 
ciples by the Third Party and not a violation by the Web site. It is intended that 
the Accountability programs would enforce against such Third Parties to bring 
them into compliance with the Principles. Likewise, where a Third Party engaged 
in Online Behavioral Advertising is in compliance with the Transparency and 
Choice Principles and is listed on the industry-developed Web site(s), failure of 
a Web site where data is collected for use for Online Behavioral Advertising to 
include the link on its Web site as required under II.B. would be a violation of 


the Principles by the Web site and not a violation by the Third Party. 


Ill. CONSUMER CONTROL 


Part III provides the consumer with more control over the collection and use 
of its data for Online Behavioral Advertising purposes. This principle sets forth 
guidelines that will enable users of Web sites at which data is collected and used 
for Online Behavioral Advertising purposes the ability to choose whether data 


is collected and used for such purposes. This principle requires entities involved 
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in the collection and use of data for Online Behavioral Advertising purposes to 
provide users a means of controlling the collection and use of data for Online 


Behavioral Advertising purposes. 


Principle III.A requires a Third Party to provide users of the Web site at which 

it collects data for use for Online Behavioral Advertising purposes the ability 

to choose whether data is collected and used for such purposes. In addition, 

the Principle provides users with choice where the data is collected for Online 
Behavioral Advertising purposes by the Web site about the transfer of such data 
to a non-Affiliate. The principle requires the Third Party to provide a choice 
mechanism either on its own Web site; on an industry-developed Web site; or 
listed individually in the disclosure of the Web site where data is being collected 
for Online Behavioral Advertising, if permitted by that Web site. A Third Party 
will satisfy the Consumer Control Principle when a consumer has been provided 
a link from “in or around” the advertisement on the Web page where data is 
collected that links to a disclosure on the Third Party’s Web page where choice is 
available not to have the data collected or used for such purpose. An example of 
a mechanism that would satisfy the choice requirement would be a mechanism 
that allows a user to stop the collection and use of data for Online Behavioral 
Advertising purposes. Choice under II.A does not require an individual’s action 


in response to the notification of Online Behavioral Advertising practices. 


Similarly a Third Party will satisfy the choice requirement where the Third Party 
is listed on the industry-developed Web site(s). An industry-developed Web site 
that provides a choice mechanism will be particularly useful for Third Parties 
that do not have a link to a notice in or around the advertisement or in situations 


where multiple Third Parties are collecting and using data from an advertise- 
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ment. These Third Parties could now provide the consumer with more control by 
pointing to the industry-developed Web site or Web sites for different industry 
segments, to assist consumers in their election of how data is collected and used 


for Online Behavioral Advertising purposes. 


Finally, in instances where the Third Party is individually listed in the disclosure 
of the Web site where the data is collected as set forth in II.A.2.(b)(ii), choice 
should be available from the Third Party(s) disclosure linked from the page where 
the Third Party is individually listed. 


Principle III.B applies to Service Providers for those services that fall within the 
definition. The Principles would not apply to an entity for those other services, 
not within the definition of Service Provider, that they may offer as a Web site, 
Third Party, or otherwise. For example, when an Internet access service provider 
also operates a Web site, the provisions of principle II.B would not apply to the 
Service Provider’s activities at its own Web site, but would apply to the Service 
Provider’s activities in connection with providing Internet access services or 
downloading its Web browser. This principle recognizes that the privacy concerns 
regarding Online Behavioral Advertising are amplified when providers of services 
can — by virtue of the services they provide to consumers with whom they have 
relationships - potentially gain access to all or substantially all of their customers’ 


Web surfing behavior. 


Recognizing the central role they play, this Principle holds Service Providers to 
a high standard by requiring that customers take action in response to a clear, 
meaningful, and prominent notice regarding their Service Provider’s collection 


and use of Web surfing data for Online Behavioral Advertising purposes. It pro- 
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hibits Service Providers from the collection of data through such service and use 
of such data for Online Behavioral Advertising purposes absent their customers’ 
Consent for such purposes; this Principle requires an authorized user to take ac- 
tion assenting to the collection and use of data for Online Behavioral Advertising 
after having been meaningfully informed by the Service Provider of such activi- 
ties. Service Providers that have obtained customer Consent to the collection and 
use of data for Online Behavioral Advertising purposes would also be required to 
provide these individuals with an ongoing means of withdrawing their Consent 
to such activity. The consent requirement applies to Service Providers only when 
acting in their capacity as providers of Internet access services, or Web tool bar, 


browser, or other desktop software services. 


In addition, the Data Security Principle described in more detail below requires 
Service Providers to take steps to help de-identify the data collected and used for 


Online Behavioral Advertising. 


IV. DATA SECURITY 


Principle IV addresses data security. First, it requires all entities to maintain 
appropriate physical, electronic, and administrative safeguards in light of the sen- 
sitivity of the data collected and used for Online Behavioral Advertising purpos- 
es. This data security standard tracks the one that the FTC applies in its orders 
requiring companies to safeguard personal information. It is flexible, taking into 
account the size and complexity of a company, the scope of the activities, and the 


sensitivity of the data. 


Second, this provision requires all entities to retain data collected and used for 
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Online Behavioral Advertising purposes for no longer than necessary to fulfill a 
legitimate business need, or as required by law. It is similar to the provisions in 
the 2002 DoubleClick agreement with state attorneys general insofar as it recog- 
nizes that data used for Online Behavioral Advertising purposes may also be used 
for other purposes, and that the appropriate duration for keeping data for these 
other purposes such as testing and auditing may be longer than for behavioral 


advertising purposes. 


Third, this provision sets forth the steps that a Service Provider engaged in On- 
line Behavioral Advertising should take to help preserve the de-identified status 
of data collected and used for such advertising that is shared with non-Affiliates, 


safeguard the data, and be held accountable for the use of such data. 


The provision provides for a means of de-identifying data. This approach to 
de-identifying data is modeled on the FTC’s approach to masking online iden- 
tifiers to protect children under the Children’s Online Privacy Protection Act 
(“COPPA”). For example, the FTC has stated in COPPA FAQ 45 that Web sites 
that “hash” or otherwise alter children’s email addresses when collecting them to 
be stored and used to create a password reminder system are not deemed to be 
collecting and using personal information and, therefore, do not trigger COPPA’s 
parental consent requirement. (Hashing is a one-way, irreversible process that 
protects the original data but permits ongoing indexing of the hashed values on 
an anonymous or de-identified basis). The rule that emerges from this is that it 
suffices for purposes of protecting privacy if identifiers are altered after they are 
collected such that they cannot be reconstructed into their original form in the 
ordinary course of business but the altered form remains available to be used by 


Web sites to recognize and distinguish among specific visitors to Web sites. 
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In addition, entities, when acting as Service Providers, will agree to be held 
accountable for their collection and use of consumer data by disclosing when 
consumer data collected and used for Online Behavioral Advertising purposes 


is subjected to a de-identification process. 


Finally, an entity, when acting as a Service Provider, should take steps to safe- 
guard the data that is distributed. One example is not disclosing to non-A ffiliates 
the algorithm or other mechanism used for coding the data. Another example is 
obtaining satisfactory written assurance from the recipients of such data that: (i) 
they will not attempt to identify the data; (i1) they will use or disclose the data 
only for purposes of Online Behavioral Advertising or other approved uses such 
as content organization; and (iii) they will ensure that any additional entities to 
which they disclose the data (e.g., subcontractors) agree to the same restrictions 
and conditions to which they have agreed. If a non-Affiliate does not have any 
independent right to use the data under written contracts, the written assurances 


in this subsection are considered to have been satisfied. 


The provisions of principle IV.C. apply to Service Providers only when acting in 
their capacity as providers of Internet access services, or Web tool bar, browser, or 


other desktop software services. 


V. MATERIAL CHANGES TO EXISTING ONLINE BEHAVIORAL ADVERTISING 
POLICIES AND PRACTICES 


Part V applies to Third Parties, Web sites and Service Providers that make material 
changes to their Online Behavioral Advertising data collection and use practices. 
If such an entity plans on using, for materially different Online Behavioral 


Advertising purposes, data collected from individuals prior to the material 
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change, the Principle requires the entity to obtain Consent from the affected 
individuals for the materially different use. The Consent must be obtained before 
the entity uses the previously collected data for the materially different Online 
Behavioral Advertising purposes. Typically, a material change would be a more 
expansive collection or use of data than previously disclosed to the user. For uses 
where the change results in less collection or use of data, such a change would 
generally not be considered material and thus Consent would not be required 


under the Principles. 


The Network Advertising Initiative Guidelines contain an illustration of the type 
of material change to an entity’s Online Behavioral Advertising practices that 
requires Consent. The illustration involves the merger of PII with non-PII for 
Online Behavioral Advertising purposes. This typically would occur when an ad 
network first collects non-PII for Online Behavioral Advertising purposes, and 
subsequently has the opportunity to combine that data with PII, rendering all of 
the data PII. At the time of initial data collection, however, the consumers would 
have been informed that the data would be collected and used as non-PII. Now, 
the ad network wishes to combine the data and use it in a way not contemplated 
by the consumer at the time the data was collected. Under the NAI Guidelines, 


this practice constitutes a material change. 


Timing is particularly important under this Principle. First, the Consent require- 
ment applies regardless of whether these Principles were in effect at the time the 
data was initially collected. Second, the Consent must be obtained before the 
entity uses the previously collected data for the materially different Online Be- 


havioral Advertising purposes. 
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Vi. 


SENSITIVE DATA 


Principle VI addresses Online Behavioral Advertising involving sensitive data. The 
first part of this Principle describes the standards for Online Behavioral Advertis- 
ing for children under the age of 13 and indicates that entities should not collect 
“personal information,” as defined under the Children’s Online Privacy Protection 
Act (“COPPA”), from children they have actual knowledge are under the age of 13 
or from sites directed to children under the age of 13 for Online Behavioral Adver- 
tising, or engage in Online Behavioral Advertising directed to children they have 
actual knowledge are under the age of 13 except as compliant with the COPPA. 
COPPA requires verifiable parental consent to collection of children’s data given 


its sensitive nature. 


In addition to the sensitive area of children, this Principle addresses certain health 
and financial data. The Principle calls for entities not to collect financial account 
numbers, Social Security numbers, pharmaceutical prescriptions, or medical 
records about specific individuals for Online Behavioral Advertising purposes 


without Consent. 


This is a complex area and there may need to be additional areas that should fall 
into the sensitive data category. The entities participating in the development of 


these Principles intend to evaluate such areas if and when they may arise in the 


marketplace. 
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VII. ACCOUNTABILITY 


The Accountability Principle calls on entities participating in the development 
of these Principles to develop and implement policies and programs to further 
advance the Principles. It is intended that these programs will help ensure that all 
entities engaged in Online Behavioral Advertising bring their activities into com- 
pliance with these Principles. The Direct Marketing Association (“DMA”), which 
has more than 3,500 members, has indicated that it will integrate the Principles 
into its long-standing effective self-regulatory program. The National Advertising 
Review Council and its administrator, the Council of Better Business Bureaus 
(“CBBB”), with a long history of successful accountability programs have indi- 
cated that they are developing a new program around these Principles. The CBBB 
and DMA have been asked and agreed to work cooperatively to establish ac- 
countability mechanisms under the Principles. These organizations will develop 
and coordinate accountability programs with a stated goal of having programs in 


place at the beginning of 2010. 


The Accountability Principle calls for programs to have mechanisms by which 
they can police entities engaged in Online Behavioral Advertising and help bring 
these entities into compliance. Programs will also, at a minimum, publicly report 
instances of non-compliance and refer entities that do not correct violations to 
the appropriate government agencies. The program may report instances of non- 
compliance that have been corrected without identifying the entity whose prac- 


tices were in violation of the Principles. 


It is intended that the burden of simplifying the means by which consumers can 


complain of instances of non-compliance with the Principles will rest with the 
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program(s), not consumers. Thus, administrators of programs are encouraged to 
discuss coordination on accountability to help achieve efficiencies. These ef- 

ficiencies will help ensure that consumers have simple mechanisms to complain 
about possible non-compliance with the Principles, and that entities engaged in 


Online Behavioral Advertising are not unreasonably subject to multiple enforce- 


ment mechanisms regarding their possible non-compliance with the Principles. 





